Staff Product Security Engineer

Overview

As the founding Staff Product Security Engineer, you will work closely with the Head of Security & IT to set and execute the security strategy for the Endor Labs platform, spanning supply chain security, first-party code scanning, runtime monitoring, AI agent hardening, threat modeling and design reviews.

What you'll do

• Fix issues in the application by validating, prioritizing, and fixing findings at scale on an ongoing basis.
• Stop insecure code from being merged by building out the internal apparatus around the AI SAST product.
• Set up paved paths so everyone, from principal engineers to citizen developers, can be confident in the security of their code contributions.
• Run application security for the company, using the Endor Labs platform as a proving ground for the product.
• Work with Product and Engineering to shape the roadmap, review designs and mocks, and give feedback on implementation.
• Share what works with customers, prospects and the broader security community.

What you'll need

• 10+ years in application or product security, including staff- or principal-level technical leadership.
• A track record of building security tooling and automation that runs at scale across an engineering organization, and of measuring whether it works.
• A track record of influencing a product or platform roadmap, having turned internal security work into something other teams or customers adopt.
• Demonstrated hands-on work applying LLMs and agents to security problems, having built a harness, compared tools, or measured where they fail.
• Well-reasoned opinions on how to find, validate and fix vulnerabilities in existing code, and how best to prevent insecure code from being merged.
• Deep threat modeling and secure architecture skills.
• The ability to set direction and influence senior engineering, product and customer stakeholders without formal authority.
• A fix-it mindset: investigating, finding root causes, and driving remediation rather than just reporting.
• Comfort building from scratch in an ambiguous, fast-moving environment and setting priorities without an established playbook.

Nice to have

• Experience securing build systems and CI/CD at scale, especially Bazel monorepos.
• A background in security research, such as vulnerability research, program analysis, or static analysis tooling.
• Conference talks, publications, or open-source work in application security.

Details

• Location: Remote, US.